none
Two sets of PWA Permission Levels in PWA 2010 RRS feed

  • Question

  • Does anyone have come across an issue where you get two sets of PWA Permissions Levels?

    In PWA 2010 site, when I go to Site Actions > Site Permissions > Permission Levels I see following besides standard set of Sharepoint permission levels:

    Web Administrators (Microsoft Office Project Server)
    Project Managers (Microsoft Office Project Server)
    Team Members (Microsoft Office Project Server)
    Readers (Microsoft Office Project Server)

    and then

    Web Administrators (Microsoft Project Server)
    Project Managers (Microsoft Project Server)
    Team Members (Microsoft Project Server)
    Readers (Microsoft Project Server)

    Somehow sharepoint user's access is getting revoked automatically. Not sure as of now if it is due to this duplicate permission levels.

    Any idea what could cause this and how to fix?

    Thursday, June 9, 2011 3:52 PM

Answers

  • Everyting back to normal now. Few updates:

    1. After the Bulk Update project site and syncing permissions, on all sites most users are showing having two permission levels - one each for (Microsoft Office Project Server) and (Microsoft Project Server) for the right groups though. If someone was Reader (Microsoft Office Project Server) they show up with both reader permission levels, if someone was Team Member, they show up with both team member permission levels.

    Removing the permission levels with (Microsoft Office Project Server) in the names from a project workspace site seems to be show only one permission level and is working.

    2. If I go to Site Actions > Site Permissions under http://server/pwa there I see users are assigned to permission levels with (Microsoft Office Project Server) in the names. Under Permission levels section I see both set of project permission levels. Is there a way to force the sharepoint permission / permission level sync at /PWA level?

    Is there a way to confirm (besides how I tested using a new project publish) what permission levels PWA 2010 is currently attahced with if you see two set of permission levels?

     

    Friday, June 10, 2011 4:05 PM

All replies

  • Hi,

    How are you giving users permission to PWA? Via Site Action > Site Permissions or via the PWA > Server Settings > Manager Users? If you are giving users access via site actions >  site permissions then the users will be removed when a user synch jobs runs in Project Server. When adding users via the Manager users option you shouldn't see this issue.

    Hope that helps

    Thanks

    Paul


    Paul Mather
    Thursday, June 9, 2011 4:07 PM
    Moderator
  • Even the users who were in PWA, were part of the project(s), had assignment in project, has their sharepoint workspace permissions revoked!

    The second set of users who are not part of PWA and doesn't have account in PWA, if they are given Sharepoint workspace access using Site actions > site Permissions, does their sharepoint permissions get revoked by sync? How about if they are assigned Sharepoint Permission Level (Full Control, Contribute, Reader etc) as oppose to Project Server Permission Levels (Web Admin, Project Managers, Team Members, Readers)?

    Thursday, June 9, 2011 4:21 PM
  • Ok, so its Project Site permissions that are being removed and not the top level Project Web App site permissions. How were the users added to the Project Sites, manually or automatically via the project server user synch job? It is only the Project Server permission levels that are synchronised

    thanks

    Paul


    Paul Mather
    Thursday, June 9, 2011 4:32 PM
    Moderator
  • Both, manually and automatically. Users who were not part of the proejct but wanted to review the project workspace were given access manually in sharpeoint.
    Thursday, June 9, 2011 4:36 PM
  • Ok, the users who have been added manually with the SharePoint permissions (non Project Server) shouldn't be removed automatically, likewise users who gained access with the User Synch job should still have access if they meet the following criteria if you automicatilly synch the PWA users with the Project Sites:

    • Project managers who have published a project or who have Save Project permissions on a project are added to the Project Managers (Microsoft Project Server) site group.
    • Team members with assignments in a project are added to the Team members (Microsoft Project Server) site group.
    • Other Project Server users who have View Project Site permission on a project are added to the Readers (Microsoft Project Server) site group.

    Do you have any failed User Synch jobs in the queue?

    Thanks

    Paul


    Paul Mather
    Thursday, June 9, 2011 4:43 PM
    Moderator
  • This is what I thought what application does. Few exception I have noticed

    1. It initially removed users from project workspace sites who had sharepoint permissions (contribute, read etc) assigned.
    2. It removed some of the users who had Team Member PWA group assigned, had even task assignments in project and had Team Members sharepoint permission level in workspace.

    I don't see any failed job in queue.

    Note: This is a 2007 to 2010 migrated PWA.

    Thursday, June 9, 2011 4:58 PM
  • Can you consistently replicate this on a new Test Project and Project Site? If you create a new project and add one user to a task, save and publish this project and create a site at the same time. Navigate to the new Project Site and confirm that the user added in the previous step has been given the Team members (Microsoft Project Server) permission. Now add another user directly to the site giving them the SharePoint Reader permission, navigate back to PWA > Server Settings > Project Sites, select the new test site and click the synchronise button at the top. Confirm that the job has successfully completed in the queue. Navigate back to the new test Project Site and see if both users are still showing in the Site Permissions.

    Thanks

    Paul


    Paul Mather
    Thursday, June 9, 2011 5:16 PM
    Moderator
  • For a new test project everything works as normal except that new workspaces are only getting permission levels with (Microsoft Project Server) in the names.

    For old sites permission levels only show (Microsoft Office Project Server) in the names. using the Synchronize under Server Settings > Project Sites for individual workspaces, brought the other set of permission levels (Microsoft Project Server) in that workspace's permission level area. It also added users to the (Microsoft Project Server) permission levels within that workspace only besides their original permission level (Microsoft Office Project Server).

    I then used the Server Settings > Bulk Update Project Sites. Under Update Site Paths, I used the same url for project workspaces site collection for previous and new paths. But under Project Sites Permissions section I checked the option Synchronize site permissions and hit update button. All workspaces got synced with permissions. This added the second set of permission levels with (Microsoft Project Server) in the names. Now I was able to see project users who have task(s) assigned in the project with appropriate (Microsoft Project Server) permission levels assigned. That was good.

    For one of the project workspace site as test, I removed all permission levels with (Microsoft Office Project Server) in the names and left all with (Microsoft Project Server) there.

    I'll continue the test and see how that goes.

    I also found this blog with some but not completely the same issue.

     Resetting Lost Permissions in Project Server 2010

    http://bit.ly/mgsxbY

    Thursday, June 9, 2011 8:58 PM
  • You should get more consistent results with old and new sites now that you have bulk updated the old sites.

    If you have any further issues, let us know.

    thanks

    Paul


    Paul Mather
    Thursday, June 9, 2011 10:06 PM
    Moderator
  • Everyting back to normal now. Few updates:

    1. After the Bulk Update project site and syncing permissions, on all sites most users are showing having two permission levels - one each for (Microsoft Office Project Server) and (Microsoft Project Server) for the right groups though. If someone was Reader (Microsoft Office Project Server) they show up with both reader permission levels, if someone was Team Member, they show up with both team member permission levels.

    Removing the permission levels with (Microsoft Office Project Server) in the names from a project workspace site seems to be show only one permission level and is working.

    2. If I go to Site Actions > Site Permissions under http://server/pwa there I see users are assigned to permission levels with (Microsoft Office Project Server) in the names. Under Permission levels section I see both set of project permission levels. Is there a way to force the sharepoint permission / permission level sync at /PWA level?

    Is there a way to confirm (besides how I tested using a new project publish) what permission levels PWA 2010 is currently attahced with if you see two set of permission levels?

     

    Friday, June 10, 2011 4:05 PM